LegionLoader

ErrTraffic begins after someone reaches a compromised WordPress website. The injected JavaScript does not contain the final destination in clear text.

Initial access The malware is delivered by “drive by download” technique.

In this campaign we observed a PowerShell script being downloaded that installs a malicious Chromium-based browser extension that targets Google Chrome, Brave and Opera.

The command used for extraction is as follows: "C:\Users\???\AppData\Roaming\Viqwo Stars Ci\Rotq App\UnRar.exe" x -p3809610121t -o+ ...

ErrTraffic begins after someone reaches a compromised WordPress website. The injected JavaScript does not contain the final destination in clear text.

This includes resolving LdrLoadDll, which loads bcrypt.dll while bypassing the more commonly hooked LoadLibrary call.

The sample requires user interaction to execute, triggered by the execution of the setup.msi file.

The malicious links or ads on the sites redirect users to malicious sites such as fake file-sharing services.

The archive contains several legitimate DLLs and a malicious Setup.exe file that the user needs to execute manually to initiate the infection chain.

The main purpose of the malware that is dropped by the Satacom downloader is to steal BTC from the victim’s account by performing web injections into targeted cryptocurrency websites. The malware attempts to do this by installing an extension for Chromium-based web browsers.

Finally, the PS script recursively searches for any link (.LNK) file in the above locations and modifies the “Target” parameter for all existing browser shortcuts with the flag “–load-extension=[pathOfExtension]” so that the shortcut will load the browser with the malicious extension installed.

The shellcode then proceed to start explorer.exe and use process hollowing to load the malicious stage 2 using CreateProcessInternalA, ZwQueryInformationProcess, ReadProcessMemory, ZtUnmapViewOfSection, VirtualAllocEx, WriteProcessMemory and NtResumeThread API calls.

Finally, the PS script recursively searches for any link (.LNK) file in the above locations and modifies the “Target” parameter for all existing browser shortcuts with the flag “–load-extension=[pathOfExtension]” so that the shortcut will load the browser with the malicious extension installed.

Stack-string construction, dynamic API resolution via LdrGetProcedureAddress, API hammering, and display device enumeration defeat both static and dynamic analysis at every stage.

The shellcode then proceed to start explorer.exe and use process hollowing to load the malicious stage 2 using CreateProcessInternalA, ZwQueryInformationProcess, ReadProcessMemory, ZtUnmapViewOfSection, VirtualAllocEx, WriteProcessMemory and NtResumeThread API calls.

This buffer is then decoded, revealing the shellcode... Another buffer in then created and data is copied to it using the rep movsb instruction. This buffer is then decoded, revealing the stage 2 executable.

Since the malware later attempts to execute the payload using rundll32, it is highly likely that the final payload is a DLL...

Within the MSI, two anti-sandbox mechanisms have been identified. The first anti-sandbox measure presents a button with the label “Please verify that you are not a robot.”. In one of the samples, it was observed that a virtual environment is detected through a feature of Advanced Installer.

For example, it has the ability to retrieve the victims’ addresses, obtain account information, bypass 2FA, and much more.

For example, it can extract information through the browser, such as the system information, cookies, browser history, screenshots of opened tabs, and even receive commands from the C2 server.

Appendix II – MITRE ATT&CK Mapping This table contains all the TTPs identified during analysis of the activity described in this report.

For example, it can extract information through the browser, such as the system information, cookies, browser history, screenshots of opened tabs, and even receive commands from the C2 server.

For example, it has the ability to retrieve the victims’ addresses, obtain account information, bypass 2FA, and much more.

Within the MSI, two anti-sandbox mechanisms have been identified. The first anti-sandbox measure presents a button with the label “Please verify that you are not a robot.”. In one of the samples, it was observed that a virtual environment is detected through a feature of Advanced Installer.

After that, the script searches for the possible locations of shortcuts for each of the targeted browsers in such places as Desktop, Quick Launch and Start Menu.

Appendix II – MITRE ATT&CK Mapping This table contains all the TTPs identified during analysis of the activity described in this report.

JavaScripts: requesting commands from the C2 (left pane) and taking screenshots (right pane)

The malicious extension has various JS scripts to perform browser manipulations while the user is browsing the targeted websites, including enumeration and manipulation with cryptocurrency websites.

The extension performs various actions on the account in order to remotely control it using the web inject scripts, and eventually the extension tries to withdraw the BTC currency to the threat actors’ wallet.

This archive contains 2 files: A 7zip password protected archive, the sole purpose of this protection is to bypass malware analysis; and a picture file reminding the password of the next archive to the victim.

Stage 2 is responsible for communicating with the command and control (C2) server... the malware attempts to establish a connection to the C2 using WinHttpSendRequest.

To do so, it performs a DNS request to don-dns[.]com through Google DNS (8.8.8.8, another decrypted string) and it queries for the TXT record.

Researchers also found a malicious MSI with a Node.js backdoor that used Tor for command-and-control traffic

Downloads a shellcode, saves it as a .dat file, decrypts it using XTEA, and executes it in memory. The malware downloads an additional file from the C2 using URLDownloadToFileA...

The reason for using the last cryptocurrency transaction of a specific wallet to retrieve the C2 address is that the server address can be changed by the threat actors at any time.

MITRE ATT&CK Coverage ... Command and Control ◦ T1573 Encrypted Channel

For example, it can extract information through the browser, such as the system information, cookies, browser history, screenshots of opened tabs, and even receive commands from the C2 server.